Identity
The presented vault-bound key resolves one Talon agent and tenant before any policy decision.
Integration · LangGraph
Keep LangGraph as the orchestrator. Give the use case one Talon identity.
LangGraph builds and runs the workflow. Talon does not replace it. Define one agent file, bind one vault key, and route supported model traffic through Talon when the use case needs shared cost controls, one effective policy, policy-preserving provider paths, session evidence and a common operational history.
LangGraph workflow
→ model client + Talon agent key
→ Talon control plane
→ authenticate agent + derive tenant
→ resolve effective policy
→ PII + tool-schema checks
→ cost decision
→ provider path / fallback policy
→ signed runtime evidence
→ model provider
LangGraph keeps orchestration.Keep orchestrationAgent-key identityEffective policyShared budgetsReliability pathSession evidence
Why add a control plane
The second and third AI use cases should not rebuild the same controls.
LangGraph gives the application a strong agent runtime. Talon addresses the cross-use-case operating problem: authenticated use-case identity, common spend rules, provider/model/data/tool policy, provider-path evidence and session history on traffic that crosses Talon.
Policy
The organization baseline and one LangGraph-use-case override resolve into one policy for primary and fallback paths.
History
Inspect signed decisions and agent-scoped asserted-session evidence without turning application logs into the sole source of truth.
Define the use case
Bind the LangGraph application to one encrypted Talon key.
The agent file is the use-case identity and policy override. The raw key never belongs in YAML; store it in the Talon vault and put the secret reference in agent.key.secret_name.
agent:
name: langgraph-support
tenant_id: acme
key:
secret_name: langgraph-support-talon-key
policies:
cost_limits:
daily: 10.00
models:
allowed: [gpt-4o-mini]Minimal setup
Point the LangGraph model client at Talon.
Keep the LangGraph graph and application logic; change the supported provider client base URL and use the value minted into the agent's vault secret as the SDK API key.
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(
model="gpt-4o-mini",
base_url="http://localhost:8080/v1/proxy/openai/v1",
api_key="<talon-agent-key>",
)
# Use llm inside LangGraph nodes as usual.What the key controls
Identity, budget and policy stay bound to the AI use case.
| Concern | Runtime behavior |
|---|---|
| Identity | The bearer key resolves the Talon agent and tenant; the request cannot substitute another identity. |
| Cost | Per-request, daily, monthly and session limits come from the agent's resolved effective policy. |
| Models/providers | Organization, agent and provider restrictions are evaluated on the primary route and every fallback candidate. |
| Evidence | Agent, tenant, policy digests, provider path and decision outcome are signed in the runtime record. |
Boundary
Talon governs the path, not the whole graph.
Model requests routed through Talon can be controlled and evidenced. Tool schemas visible to the gateway can be filtered. Local Python actions, direct APIs and tool execution that bypass Talon remain outside its view.
| LangGraph activity | Talon visibility |
|---|---|
| Model API request routed through Talon | Authenticated, governed and evidenced. |
| Tool schema included in governed LLM request | Can be filtered or blocked by supported gateway policy. |
| MCP/tool call routed through Talon interception | Can be governed on the supported path. |
| Local node code, shell command or direct API bypass | Invisible and uncontrolled by Talon. |
Sessions and subagents
Attribute the workflow inside the authenticated agent boundary.
A custom orchestrator can pass an asserted session id and free-form subagent labels. They explain fan-out but do not replace the authenticated Talon agent. Session state and budget remain scoped to tenant plus agent.
X-Talon-Session-ID: sess-support-4711
X-Talon-Agent-ID: researcher
X-Talon-Parent-Agent-ID: planner
X-Talon-Stage: generation
# attribution inside langgraph-support
# not an independent policy identityVerify
Inspect the use case after a run.
Use current CLI surfaces to review recent evidence, explain one decision, verify integrity and inspect cost.
talon audit list --limit 10
talon audit show <evidence-id>
talon audit verify <evidence-id>
talon costs --agent langgraph-supportStart with one graph
Give one LangGraph use case an identity on the common path.
Choose a workflow with real spend, sensitive data or repeated model calls. Create its agent file, mint the key, route provider traffic through Talon and inspect the resulting runtime decisions.